https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36753#M8168 <P>How do I re-index the prior data , please help</P> Fri, 16 Nov 2012 07:10:15 GMT abhayneilam 2012-11-16T07:10:15Z https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36749#M8164 <P>Hi,</P> <P>I have a field in a file which contains the date which is in dd/mm/yyyy format as follows:</P> <P>BEGIN_TIME NAME LOC<BR /> 5/11/2012 abhay kolkata<BR /> 6/11/2012 murari raniganj</P> <P>These two data is of 5th and 6th November 2012 , but When I am searching with the BEGIN_TIME field I am not getting these value( I am getting no data , because SPLUNK is considering 11th May and 11th June data )</P> <P>Please suggest me how to solve this issue , need ur urgent help </P> <P>Thanks for your help!!</P> Fri, 16 Nov 2012 04:15:11 GMT https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36749#M8164 abhayneilam 2012-11-16T04:15:11Z https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36750#M8165 <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/admin/Propsconf">In props.conf</A> you can declare the TIME_FORMAT for this particular source/sourcetype etc..</P> <P>More info here : <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Data/Configuretimestamprecognition">http://docs.splunk.com/Documentation/Splunk/5.0/Data/Configuretimestamprecognition</A></P> Fri, 16 Nov 2012 04:23:33 GMT https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36750#M8165 Damien_Dallimor 2012-11-16T04:23:33Z https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36751#M8166 <P>I wrote TIME_FORMAT = %d/%m/%Y in props.conf and it is working fine for the newly imported data, but still facing the same issue for the data which has been already imported, How to get out of that problem , please help, props.conf will help me out for the new data imported but not the data which is already imported</P> <P>Thanks in advance !!</P> <P>Please help</P> Fri, 16 Nov 2012 05:50:10 GMT https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36751#M8166 abhayneilam 2012-11-16T05:50:10Z https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36752#M8167 <P>You'll need to re index the prior data.</P> Fri, 16 Nov 2012 06:19:15 GMT https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36752#M8167 Damien_Dallimor 2012-11-16T06:19:15Z https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36753#M8168 <P>How do I re-index the prior data , please help</P> Fri, 16 Nov 2012 07:10:15 GMT https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36753#M8168 abhayneilam 2012-11-16T07:10:15Z https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36754#M8169 <P><A href="http://splunk-base.splunk.com/answers/50339/timestamp-issue-in-splunk">http://splunk-base.splunk.com/answers/50339/timestamp-issue-in-splunk</A></P> Fri, 16 Nov 2012 07:20:36 GMT https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36754#M8169 smolcj 2012-11-16T07:20:36Z https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36755#M8170 <P>You do know there's a product manual?...I mean sure we're here to help but you'll solve problems so much quicker if you could read up on things instead of asking about every small detail here.</P> Fri, 16 Nov 2012 08:23:23 GMT https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36755#M8170 Ayn 2012-11-16T08:23:23Z https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36756#M8171 <P>I have read the documents but since I dont have any real time exp, I am not able to connect the real solutions with my problems, when I am getting the ans from you guys then it is clicking in my mind "oh ok ok so this one is the solution for this problem, I have read this before" ...I myself wrote the TIME_FORMAT = %d/%m/%Y line in props.conf and got it done, but again facing same issue for already indexed data</P> Fri, 16 Nov 2012 08:36:46 GMT https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36756#M8171 abhayneilam 2012-11-16T08:36:46Z https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36757#M8172 <P>Right. Well you will need to reindex your data. Just use the info in the link above.</P> Fri, 16 Nov 2012 08:56:50 GMT https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36757#M8172 Ayn 2012-11-16T08:56:50Z https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36758#M8173 <P>I am using following commands :</P> <P>$SPLUNKHOME/bin/splunk stop<BR /> $SPLUNKHOME/bin/splunk clean eventdata -index myindex -f<BR /> $SPLUNKHOME/bin/splunk start</P> <P>after that I am going to create a new index "newmyindex" and rest of the configuration will be the same , will it work if I do like that ?</P> <P>Please suggest</P> Fri, 16 Nov 2012 09:41:37 GMT https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36758#M8173 abhayneilam 2012-11-16T09:41:37Z https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36759#M8174 <P>Sounds about right. Why not try it with some sample data? That's the easiest way to learn.</P> Fri, 16 Nov 2012 11:09:24 GMT https://community.splunk.com/t5/Splunk-Search/problem-with-the-date-and-timestamp/m-p/36759#M8174 Ayn 2012-11-16T11:09:24Z